Detecting and blocking drive sharing worms
AssigneeSymantec Corporation
InventorCarey Nachenberg
Life of this patent
Estimating the term…
Abstract
A worm detection module (WDM) (212) stops worms and other malicious software from spreading among computer systems (100) on a network (210) via open drive shares. The WDM (212) monitors (310) a storage device (108) for activity (314, 316) directed to executable files by remote processes. The WDM (212) flags (318) files (216) that are the target of such activity. If a flagged file (216) attempts to create an executable file (218) on a networked computer system (100B), the WDM (212) detects (322) that the flagged file (216) is a worm. In response, the WDM (212) blocks the write to the networked computer system (100B) and thereby prevents the worm from propagating.
Claims21
A method for halting propagation of malicious software among computer systems connected to a network, comprising:
- identifying an executable program on a storage device of a first computer system, the executable program created or changed responsive to activity initiated on another computer system connected to the network;
- detecting whether the identified executable program attempts to create or change an executable program on another computer system on the network;
- and
- responsive to a positive detection, detecting that the identified executable program is malicious.
A computer program product comprising:
- a computer-readable medium having computer program code modules embodied therein for halting propagation of malicious software among computer systems connected to a network, the actions performed by the computer program code module comprising:
- identifying an executable program on a storage device of a first computer system, the executable program created or changed responsive to activity initiated on another computer system connected to the network;
- detecting whether the identified executable program attempts to create or change an executable program on another computer system on the network;
- and
- responsive to a positive detection, detecting that the identified executable program is malicious.
A system for halting propagation of malicious software among computer systems connected to a network, comprising:
- a worm detection module adapted to execute on a first computer system connected to the network, the worm detection module adapted to perform actions comprising:
- identifying an executable program on a storage device of a first computer system, the executable program created or changed responsive to activity initiated on another computer system connected to the network;
- detecting whether the identified executable program attempts to create or change an executable program on another computer system on the network;
- and
- responsive to a positive detection, detecting that the identified executable program is malicious.
Dependencies are inferred from the claim text.